# Changelog

All notable changes to CWS Model Context Protocol will be documented in this file.

## [1.6.5] - 2026-07-22

### Added
- **MCP Router Admin Tab** — the MCP Router tab in the plugin settings is now visible, exposing the first-party MountDev MCP Router configuration UI that was previously hidden. (e03203b)

### Changed
- **MountDev MCP Router Callback Hosts Allowed** — `cascadiawebservices.com` is now registered as allowed OAuth redirect hosts so the first-party MCP Router can complete the authorization code flow. (e03203b)

## [1.6.4] - 2026-07-20

### Security
- **Critical: OAuth Authorization Bypass (CVE-2026-15015) — actually fixed this time.** `/oauth/authorize` no longer auto-selects the site's first administrator and issues an authorization code to any unauthenticated caller. It now requires a logged-in WordPress user and an explicit Approve/Deny consent screen, and the resulting code and token are bound to the user who approved — so the per-tool capability checks in `Tool_Registry` actually constrain what the token can do. **This vulnerability was present in 1.6.0 through 1.6.3 inclusive; see the retraction under 1.6.1 below.** (4010910)
- **Redirect URI Allowlist Enforced** — `redirect_uri` is now validated before an authorization code is issued, and again at token exchange. Matching is on the parsed host, not a string prefix, so `https://chatgpt.com.evil.test/` no longer passes. Loopback callbacks are permitted per RFC 8252 with the port ignored. The allowlist is extensible via the `mountdev_ai_mcp_connector_allowed_redirect_uris` and `mountdev_ai_mcp_connector_allowed_redirect_hosts` filters.
- **All Existing OAuth Tokens Revoked On Upgrade** — any authorization code, access token, or refresh token issued before this release may have been obtained through the bypass, and refresh tokens are valid for 30 days. All are deleted on upgrade. **Every connected client must authorize again.**
- **Legacy Self-Registered Clients Purged** — clients that self-provisioned through Dynamic Client Registration before 1.6.3 were still accepted at runtime even after DCR was removed. They are no longer honoured, and the stored records are deleted on upgrade and on uninstall.
- **PKCE Now Mandatory, S256 Only** — `code_challenge` is required on every authorization request, `plain` is rejected at request time and in `verify_pkce()`, and all three OAuth metadata documents now advertise `S256` only.
- **Authorization Codes Bound To Their Client** — the code is now checked against the `client_id` and `redirect_uri` it was issued for (RFC 6749 §4.1.3), and is invalidated on any failed redemption rather than remaining replayable for its full 10-minute lifetime. The refresh grant now validates client identity, which it previously did not do at all.

### Fixed
- **Authorization Endpoint Moved Out Of The REST API** — `/oauth/authorize` is now served at `init` priority 1. WordPress core's `rest_cookie_check_errors()` calls `wp_set_current_user( 0 )` for cookie-authenticated REST requests that carry no `X-WP-Nonce`, which a top-level browser navigation from an OAuth client never does. Inside REST, a login check therefore always failed and the flow looped between `/oauth/authorize` and `wp-login.php`. This is why the fix originally written for 1.6.1 was reverted before release. The advertised endpoint URL is unchanged; the `?rest_route=` form used on Plain permalinks is handled too. (4010910)
- **Post-Login Redirect Hijacking** — if a host or plugin forces every login to its own page, the authorization flow is now resumed from wherever the user landed, on the next page load, rather than trying to win a race on the `login_redirect` filter. (4010910)

### Changed
- **Consent Screen Rewritten** — the screen now names the requesting host, the signed-in account and role, and the active profile with its description and tool count, so the grant is described concretely rather than as "act on your behalf". Adds a phishing caution, a "sign in as someone else" path that preserves the pending request, dark mode, responsive layout and keyboard focus styles. (235212e)

### Upgrade Notes
- **All existing OAuth tokens are revoked on upgrade.** Every connected AI client (Claude, ChatGPT) will receive a 401 and must reconnect. This is required: any token issued before 1.6.4 may have been obtained through the bypass, and refresh tokens are valid for 30 days.
- No action is needed for Application Password connections (Claude Desktop via the bundled bridge) — that authentication path is unaffected.

## [1.6.3] - 2026-07-09

### Security
- **Dynamic Client Registration Removed** — `/mcp-register`, `/register`, and the REST `/oauth/register` route (plus the `registration_endpoint` metadata field) have been removed. Only admin-issued OAuth credentials (generated from the plugin's admin panel) can be used to connect; clients can no longer self-provision a `client_id`/`client_secret`. `/mcp-token` and `/token` are unaffected.

## [1.6.2] - 2026-07-09

### Added
- **7 New Navigation Menu Tools**
  - `update_nav_menu` — rename an existing menu
  - `delete_nav_menu` — delete a menu and all of its items
  - `add_menu_item` — add a custom link, post/page, or taxonomy term item to a menu
  - `update_menu_item` — update an existing menu item (title, URL, target, classes, position, parent, etc.)
  - `delete_menu_item` — remove an item from a menu
  - `get_menu_locations` — list theme-registered nav locations and which menu is assigned to each
  - `set_menu_location` — assign or unassign a menu to a theme location so it displays on the site

### Fixed
- **Menu Management Was Read/Create Only** — `Menu_Tools` previously only supported listing menus and creating a new (empty) one; there was no way to rename or delete a menu, manage its items, or assign it to a theme location, so AI clients could not actually build or maintain navigation (cf1daf9)

### Changed
- Tool count increased from 382 to 389 total tools (75 to 82 WordPress core)
- `developer` and `site_admin` profiles updated to include all 11 menu tools (previously `developer` only had 3, and `site_admin` had none)

### Technical
- `update_menu_item` seeds unspecified fields from the item's current values before calling `wp_update_nav_menu_item()`, since that WP core function otherwise resets any omitted field to blank on update

## [1.6.1] - 2026-07-09

### Retracted — these entries were published in error

> **The security fixes listed below never shipped.** The commit implementing them
> (`51b9ca6`) broke the OAuth flow for both Claude and ChatGPT and was reverted
> (`5b56b8c`) before 1.6.1 was released. The entries were not removed from the
> changelog at the time, so 1.6.1, 1.6.2 and 1.6.3 all shipped claiming a fix that
> was not present in the code.
>
> **CVE-2026-15015 remained exploitable in every release up to and including
> 1.6.3.** It is fixed in 1.6.4. If you are running any earlier version, upgrade and
> assume any OAuth token issued by your site may have been obtained by a third
> party — 1.6.4 revokes them all automatically.
>
> The original text is retained below, struck through, for the record.

- ~~**Critical: OAuth Authorization Bypass (CVE-2026-15015)** — `/oauth/authorize` no longer auto-selects the site's first administrator and issues a code with no login or consent check. It now requires an authenticated WordPress session and an explicit one-click Approve/Deny consent screen before a code is ever generated, and the resulting code/token is bound to whichever user actually approves it, not an arbitrary admin~~
- ~~**Redirect URI Validation** — `redirect_uri` is now validated against the requesting client's registered allowlist before a code is ever issued; previously the `validate_redirect_uri()` check existed but was never called~~
- ~~**PKCE `plain` Method Rejected at Request Time** — `code_challenge_method=plain` is now rejected when `/oauth/authorize` is first requested, in addition to the existing `verify_pkce()` check~~
- ~~**Claude.ai Redirect URI** — Admin-issued OAuth credentials' `redirect_uri` allowlist now includes `https://claude.ai` (previously only `chatgpt.com` and `localhost` were allowed, which broke Claude Desktop/claude.ai once redirect_uri validation started being enforced)~~
- ~~**Login Redirect Hijacking** — The post-login redirect back to the OAuth consent screen is now re-asserted at `PHP_INT_MAX` priority on the `login_redirect` filter, and additionally intercepted at priority 1 on the `wp_login` action (some hosts/plugins force their own redirect and `exit` directly from `wp_login`, which runs before `login_redirect` is ever reached), so a host that unconditionally redirects every login elsewhere (e.g. some trial-site providers force `wp-admin/plugins.php`) can no longer strand the authorization flow before it reaches the consent screen~~

### Removed — also retracted

> Dynamic Client Registration removal was part of the same reverted commit and did
> not actually ship until 1.6.3. See the 1.6.3 entry above.

- ~~**Dynamic Client Registration (RFC 7591)** — `/mcp-register`, `/register`, and the REST `/oauth/register` route have been removed. Only admin-issued OAuth credentials (generated from the plugin's admin panel) can now be used to connect; clients can no longer self-provision a `client_id`/`client_secret`. `/mcp-token` and `/token` are unaffected.~~

## [1.6.0] - 2026-07-02

### Added
- **35 Jetpack Tools** for site management, stats, and marketing when Jetpack is active (d1b4a74, 58141e7, 3666ff6, e8cf31a, 02f8729)
  - **Module Control (4)** — `jetpack_list_modules`, `jetpack_get_module`, `jetpack_activate_module`, `jetpack_deactivate_module`
  - **Status & System (3)** — `jetpack_get_connection_status`, `jetpack_get_plugin_options`, `jetpack_get_system_info`
  - **Stats & Analytics (5)** — `jetpack_get_stats_summary`, `jetpack_get_top_posts`, `jetpack_get_referrers`, `jetpack_get_search_terms`, `jetpack_get_post_stats`
  - **Related Posts (3)** — `jetpack_get_related_posts`, `jetpack_get_related_posts_settings`, `jetpack_update_related_posts_settings`
  - **Content Tools (4)** — `jetpack_list_portfolio_items`, `jetpack_list_testimonials`, `jetpack_list_form_responses`, `jetpack_get_form_response`
  - **SEO & Social (7)** — `jetpack_get_seo_settings`, `jetpack_update_seo_settings`, `jetpack_get_post_seo`, `jetpack_update_post_seo`, `jetpack_get_verification_tokens`, `jetpack_update_verification_tokens`, `jetpack_get_publicize_connections`
  - **Sharing & Subscriptions (5)** — `jetpack_get_sharing_settings`, `jetpack_update_sharing_settings`, `jetpack_get_subscription_stats`, `jetpack_get_subscription_settings`, `jetpack_update_subscription_settings`
  - **Protect & Engagement (4)** — `jetpack_get_protect_settings`, `jetpack_update_protect_whitelist`, `jetpack_get_likes_settings`, `jetpack_get_comments_settings`
- **5 New Predefined Profiles** for Jetpack (85d2568)
  - `jetpack_read_only` — connection status, modules, and system info only
  - `jetpack_analyst` — read-only plus stats, top posts, referrers, search terms
  - `jetpack_site_manager` — SEO, sharing, and publicize management
  - `jetpack_content` — Content Manager: stats plus related posts, portfolio, testimonials, and form responses
  - `jetpack_full_access` — all 35 Jetpack tools including module activation and protect settings
- **MCP Server URL** now shown as a copyable field in the OAuth credentials generated modal (13df5fb)

### Changed
- Plugin renamed to "MountDev AI MCP Connector for WordPress" across the plugin header, readme.txt, README.md, and admin views (ac362be)
- Tool count increased from 347 to 382 total tools (347 existing + 35 Jetpack)

### Fixed
- **OAuth Token Exchange Failure** — Resolved token exchange failures for Claude Desktop and claude.ai; token, registration, and metadata endpoints are now served outside `/wp-json/` so security plugins (Wordfence, iThemes, etc.) can no longer intercept unauthenticated OAuth requests (acd80bc)
- **OAuth `/authorize` Fallback** — Moved the `.well-known` handler to `init` priority 1 so it fires before caching plugins can short-circuit the request; added an `/authorize` and `/token` intercept for the MCP spec fallback used when `/.well-known/oauth-authorization-server` is unreachable, e.g. behind Nginx deny-dotfiles rules (1c00813)

### Technical
- Jetpack tool registration is conditional — tools only load when Jetpack is active
- Jetpack profiles are hidden in admin when Jetpack is not active
- OAuth site-path detection now accounts for subdirectory WordPress installs

## [1.5.2] - 2026-05-21

### Fixed
- **Button Size** — Adjusted create profile button size to fit within the card layout correctly (c24eca2)
- **Icon Color** — Create profile button icon color was not visible; corrected contrast (afdce4c)
- **Button Icon Alignment** — Removed dashicons from Create Custom Profile and Import Profile buttons to eliminate persistent vertical alignment issue

### Added
- **Settings Link** — Added direct settings link on the plugin list page for quicker admin access (9319906)

### Changed
- **Tested Up To** — Marked as tested up to WordPress 7.0 (99f56f7)

## [1.5.1] - 2026-05-20

### Added
- **35 Elementor Pro Tools** for Elementor Pro features when Elementor Pro is active (d3cf425, faa1b7d, 138e7d8, 1b6c73e, d6c72fa, c1fa255, c8a552f, d82e3fe, 2fea069, 2811c02, 26ad2f8, d6156bb)
  - **Form Submissions (5)** — `elementor_pro_list_forms`, `elementor_pro_list_submissions`, `elementor_pro_get_submission`, `elementor_pro_update_submission`, `elementor_pro_delete_submission`
  - **Theme Builder (4)** — `elementor_pro_list_theme_templates`, `elementor_pro_create_theme_template`, `elementor_pro_get_theme_conditions`, `elementor_pro_save_theme_conditions`
  - **Popups (4)** — `elementor_pro_list_popups`, `elementor_pro_get_popup`, `elementor_pro_create_popup`, `elementor_pro_delete_popup`
  - **Custom Code (5)** — `elementor_pro_list_custom_code`, `elementor_pro_get_custom_code`, `elementor_pro_create_custom_code`, `elementor_pro_update_custom_code`, `elementor_pro_delete_custom_code`
  - **Global Widgets (3)** — `elementor_pro_list_global_widgets`, `elementor_pro_get_global_widget`, `elementor_pro_create_global_widget`
  - **Dynamic Tags (1)** — `elementor_pro_list_dynamic_tags`
  - **Loop Templates (2)** — `elementor_pro_list_loop_templates`, `elementor_pro_create_loop_template`
  - **Notes (3)** — `elementor_pro_list_notes`, `elementor_pro_create_note`, `elementor_pro_delete_note`
  - **Custom Fonts & Icons (2)** — `elementor_pro_list_custom_fonts`, `elementor_pro_list_custom_icons`
  - **WooCommerce Settings (2)** — `elementor_pro_get_woo_settings`, `elementor_pro_update_woo_settings`
  - **Element Permissions (2)** — `elementor_pro_get_element_permissions`, `elementor_pro_update_element_permissions`
  - **Role Manager (2)** — `elementor_pro_get_role_manager`, `elementor_pro_update_role_manager`
- **2 New Predefined Profiles** for Elementor Pro (6d5b3b1)
  - `elementor_pro_designer` — Elementor Free + Pro design tools: page editor, theme builder, popups, global widgets, loop templates, dynamic tags, and notes
  - `elementor_pro_full_access` — All Elementor Free + Pro tools including form submissions, custom code, role manager, element permissions, WooCommerce settings, and site settings

### Changed
- **Profile Manager UI** — Added category filter for easier navigation across plugin tool categories (7ec8bfb)
- Tool count increased from 312 to 347 total tools (312 existing + 35 Elementor Pro)

### Improved
- **OAuth Claude Desktop Setup Instructions** — Updated with clearer guidance (58da539)

### Technical
- Elementor Pro tool registration is conditional — tools only load when Elementor Pro is active
- Elementor Pro profiles are hidden in admin when Elementor Pro is not active

## [1.5.0] - 2026-05-14

### Added
- **36 Elementor FREE Tools** for complete page builder management when Elementor is active
  - **Foundation & Read-only (12)** — `elementor_list_pages`, `elementor_get_document`, `elementor_get_document_types`, `elementor_is_built_with_elementor`, `elementor_get_elements`, `elementor_get_element`, `elementor_list_widgets`, `elementor_get_widget_schema`, `elementor_get_global_colors`, `elementor_get_global_fonts`, `elementor_get_site_settings`, `elementor_get_system_info`
  - **Page Editor Write (8)** — `elementor_create_document`, `elementor_delete_document`, `elementor_save_document`, `elementor_add_element`, `elementor_update_element`, `elementor_duplicate_element`, `elementor_move_element`, `elementor_remove_element`
  - **Global Design System Write (5)** — `elementor_update_global_colors`, `elementor_add_global_color`, `elementor_update_global_fonts`, `elementor_add_global_font`, `elementor_update_site_settings`
  - **Template Library (5)** — `elementor_list_templates`, `elementor_get_template`, `elementor_create_template`, `elementor_delete_template`, `elementor_export_template`
  - **Backend Settings & Maintenance (6)** — `elementor_get_plugin_settings`, `elementor_update_plugin_settings`, `elementor_list_experiments`, `elementor_toggle_experiment`, `elementor_regenerate_css`, `elementor_clear_cache`
- **3 New Predefined Profiles** for Elementor
  - `elementor_read_only` — read-only access to Elementor pages, elements, widgets, global design tokens, and site settings (22 tools)
  - `elementor_designer` — full read/write access including page editor, design system, and template library (40 tools)
  - `elementor_full_access` — all 36 Elementor tools including backend settings and maintenance (46 tools)
- **Elementor Plugin Banner** displayed in admin profile category when Elementor is active
- **Elementor Tool Grouping** in admin UI with subgroups: Pages & Documents, Page Editor, Widgets, Design System, Site Settings, Templates, System

### Technical
- Elementor tool registration is conditional — tools only load when Elementor FREE is active
- Elementor profiles are hidden in admin when Elementor is not active
- Page editor write tools use load-modify-save pattern: `Document::get_elements_data()` → mutate → `Document::save()`
- Design system writes call `Files_Manager::clear_cache()` automatically after kit saves
- Element IDs are auto-generated (7-char hex) matching Elementor's native format

### Changed
- Tool count increased from 276 to 312 total tools (276 existing + 36 Elementor)

## [1.4.0] - 2026-05-08

### Added
- **20 Contact Form 7 Tools** for complete form management when CF7 is active (150f737, b8529cb, 0fafaa6, 7fd8690)
  - **Read (6)** — `cf7_list_forms`, `cf7_get_form`, `cf7_get_form_tags`, `cf7_get_mail_template`, `cf7_get_form_messages`, `cf7_get_shortcode`
  - **Write (6)** — `cf7_create_form`, `cf7_update_form`, `cf7_update_mail_template`, `cf7_update_form_messages`, `cf7_duplicate_form`, `cf7_delete_form`
  - **Advanced Config (5)** — `cf7_get_additional_settings`, `cf7_update_additional_settings`, `cf7_get_mail_tags`, `cf7_get_form_schema`, `cf7_validate_form_config`
  - **Plugin Settings & Integrations (3)** — `cf7_get_plugin_settings`, `cf7_update_plugin_settings`, `cf7_get_integrations`
- **3 New Predefined Profiles** for Contact Form 7 (150f737)
  - `cf7_read_only` — read-only access to CF7 forms and settings
  - `cf7_form_manager` — full form management including read, write, and advanced config
  - `cf7_full_access` — all CF7 tools including plugin settings and integrations
- **CF7 Plugin Banner** displayed in admin profile category when CF7 is active (fcd8752)
- **CF7 Profile Category** added to Profile Manager UI (fcd8752)

### Technical
- CF7 tool registration is conditional — tools only load when Contact Form 7 is active (7fd8690)
- CF7 profiles are hidden in admin when Contact Form 7 is not active (150f737)

### Changed
- Tool count increased from 256 to 276 total tools

## [1.3.2] - 2026-05-05

### Fixed
- **RankMath Per-Post Robots Meta** - `rankmath_get_post_meta` now returns a `robots_meta` object (noindex, nofollow, noarchive, noimageindex, nosnippet) and `rankmath_update_post_meta` accepts it, merging only the directives explicitly passed and preserving the rest. The `rank_math_robots` post meta was never being read or written (3a5ba56)
- **RankMath Schema Tools Rewrite** - All four schema functions were writing to the legacy `rank_math_rich_snippet` / `rank_math_snippet_{type}` meta keys, which Rank Math deprecated in 1.0.42+. Modern Rank Math stores each schema as a `rank_math_schema_{id}` post meta entry containing a full JSON-LD array, so reads and writes were silently no-oping:
  - `rankmath_get_post_schema` — now scans `rank_math_schema_*` keys and returns all schema entries
  - `rankmath_update_schema` — finds/updates the primary schema entry or creates a new one with correct `@type`, `articleType`, and defaults; expanded valid type list to match Rank Math's schema generator
  - `rankmath_add_faq_schema` — writes `FAQPage` schema with proper `mainEntity` → `Question`/`Answer` nesting; updates existing FAQPage if found
  - `rankmath_add_howto_schema` — writes `HowTo` schema with `step` → `HowToStep` nesting; updates existing HowTo if found

### Technical
- Added private helpers `get_post_schema_entries()` and `make_schema_meta_key()` to share schema lookup and key generation logic

## [1.3.1] - 2026-05-05

### Added
- **11 New Yoast SEO Tools** expanding coverage to 29 total Yoast tools
  - **Robot Directives** (2) - Get and update per-post robot meta directives (noindex, nofollow, etc.)
  - **Breadcrumb Title** (2) - Get and update the Yoast breadcrumb title for posts
  - **Term SEO Metadata** (2) - Get and update Yoast SEO metadata for taxonomy terms
  - **Global Settings** (1) - Get Yoast SEO global plugin settings
  - **Keyword Usage Check** (1) - Check whether a focus keyword is already used on another post
  - **Post Type Settings** (1) - Get Yoast SEO settings for a specific post type
  - **Update Redirect** (1, Premium) - Update an existing redirect via Yoast SEO Premium
  - **Inclusive Language Score** (1, Premium) - Get the Yoast inclusive language score for a post

### Fixed
- **Yoast SEO Premium Tools Unreachable** - An early return in `get_tools()` prevented Premium-only tools from ever being registered; Premium tools (redirects, multiple keywords, inclusive language) are now correctly included (c6583cd)
- **RankMath `create_redirect` Data Bug** - Tool was writing to the wrong column (`url_to` instead of `sources`) and the source/destination values were swapped, causing redirects to be stored incorrectly (ab9147b)

### Changed
- **Tool Count** increased from 245 to 256 total tools (75 WP + 74 WC + 29 Yoast + 78 Rank Math)

### Technical
- **Yoast SEO Tools Class** (`class-yoast-seo-tools.php`) restructured to register all tools including Premium in a single `get_tools()` pass; Premium tools remain gated by capability checks at runtime

## [1.3.0] - 2026-05-05

### Added
- **78 Rank Math SEO Tools** for comprehensive search engine optimization management
  - **18 Core Read Tools** - Get post meta (title, description, focus keyword, robots), social meta (OG/Twitter), canonical URL, content analysis, keyword analysis, SEO suggestions, schema types, post schema, global meta, local SEO settings, social settings, homepage SEO settings, post type settings, taxonomy settings, sitemap settings (general, HTML, post type, taxonomy)
  - **16 Core Write Tools** - Update post meta, social meta, canonical URL, schema markup; add FAQ and HowTo schema blocks; update global meta, local SEO, social settings, homepage SEO, post type settings, taxonomy settings, all sitemap settings
  - **6 Redirect & 404 Tools** - List/create/bulk-delete/export redirects; view 404 logs and 404 summary
  - **6 Analytics Tools** - Site analytics overview, detailed analytics, Search Console data, winning posts, losing posts, Content AI score
  - **32 Pro Tools** (require Rank Math Pro)
    - **Schema Templates** (2) - List and delete saved schema templates
    - **Link Genius** (6) - List/inspect/audit links, update link attributes, mark links safe, get per-post link stats
    - **Keyword Tracking** (9) - List/add/remove tracked keywords; manage keyword maps and map variations
    - **Multi-Location** (5) - List/get/create/update/delete business locations
    - **News & Video Sitemaps** (6) - Get/update news sitemap settings; get/update video sitemap settings; get/set per-post video metadata
    - **Image SEO** (2) - Get/update image SEO automation settings
    - **Email Reports** (2) - Get/update scheduled email report settings
- **3 New Predefined Profiles**
  - `rankmath_read_only` - Safe read-only access to Rank Math SEO data with essential WordPress read tools (~18 tools)
  - `rankmath_content_optimizer` - Full on-page SEO optimization with read/write access to meta, schema, and canonical URLs (~21+ tools)
  - `rankmath_full_access` - All Rank Math SEO tools including Pro features
- **Pro Badge Detection** - Profile Manager now displays a "Pro" badge on profiles that require Rank Math Pro, helping users identify which profiles need the premium plugin

### Fixed
- **Page Parent Hierarchy** - `sanitize_post_data()` was silently dropping the `parent` argument instead of mapping it to `post_parent`; pages created/updated via AI now correctly inherit their hierarchy. `format_post()` also exposes `post_parent` in responses so agents can confirm the relationship (f13f588)
- **Reading Settings Whitelist** - Added `show_on_front`, `page_on_front`, `page_for_posts`, `posts_per_rss`, `rss_use_excerpt`, and `blog_public` to the site tools option whitelist so agents can configure homepage display and feed settings (49e8a71)
- **Claude Desktop OAuth Instructions** - Added Claude Desktop OAuth setup instructions to the client setup page and generalized OAuth credentials UI for non-ChatGPT clients (51fefe1)

### Changed
- **Tool Count** increased from 167 to 245 total tools (75 WP + 74 WC + 18 Yoast + 78 Rank Math)
- **Profile Count** increased from 14 to 17 predefined profiles
- **Profile Manager** now filters Rank Math profiles when Rank Math SEO is not active
- **Full Access Profile** now includes all Rank Math SEO tools when Rank Math SEO is active

### Technical
- **Conditional Rank Math Tool Registration** - Rank Math tools only register when Rank Math SEO plugin is active
- **New Tool Class** - `Mountdev_AI_MCP_Connector\Tools\Rank_Math_SEO_Tools` with 78 tools across 5 implementation phases
- **Pro Detection** - Automatic detection of Rank Math Pro with graceful degradation for Pro-only tools
- **Capability Checks** - Read tools require `read`, write tools require `edit_posts`, settings/redirect tools require `manage_options`
- **Error Handling** - Graceful errors when Rank Math SEO or Pro is not available

### Tested With
- **WordPress** 7.0
- **WooCommerce** 10.7.0
- **Yoast SEO** 27.6
- **Rank Math SEO** 1.0.270
- **Rank Math Pro** 3.0.111
- **Contact Form 7** 6.1.6
- **Elementor** 4.0.9
- **Elementor Pro** 4.0.4

### Notes
- **No Breaking Changes** - Fully backward compatible with v1.2.x
- **Rank Math SEO Optional** - Plugin works independently; Rank Math tools only appear when Rank Math SEO is active
- **Pro Features Optional** - Pro tools gracefully degrade when Rank Math Pro is not installed
- **Automatic Upgrade** - No migration or manual steps required

## [1.2.0] - 2026-04-27

### Added
- **18 Yoast SEO Tools** for comprehensive search engine optimization management
  - **8 Read Tools** - Get SEO meta data, social meta, canonical URLs, content analysis, readability scores, keyword analysis, internal links, and cornerstone status
  - **6 Write Tools** - Update SEO meta data, social meta, canonical URLs, and schema markup
  - **4 Premium Tools** - Redirect management (list, create, delete) and multiple keyword analysis (requires Yoast SEO Premium)
- **3 New Predefined Profiles**
  - `yoast_read_only` - Safe read-only access to Yoast SEO data with essential WordPress read tools (~18 tools)
  - `yoast_content_optimizer` - Full SEO content optimization with read/write access to meta data and schema (~24 tools)
  - `yoast_full_access` - All Yoast SEO tools including Premium features (~28 tools)
- **Content Analysis Features**
  - SEO score and readability score retrieval with label interpretation
  - Focus keyword analysis with density calculation and title/content occurrence counts
  - Internal linking analysis with related post suggestions
  - Cornerstone content status checking with recommendations
- **Schema Markup Management**
  - Get and update schema.org page types (WebPage, FAQPage, AboutPage, etc.)
  - Get and update schema article types (Article, BlogPosting, NewsArticle, etc.)
- **Social Meta Management**
  - Open Graph title, description, and image management
  - Twitter Card title, description, and image management
- **XML Sitemap Status**
  - Check sitemap generation status and enabled post types/taxonomies
  - Get sitemap URLs for all content types
- **Yoast SEO Premium Support**
  - Redirect management with support for 301, 302, 307, 410, and 451 redirects
  - Plain and regex redirect formats
  - Multiple focus keywords analysis with synonyms support
  - Automatic Premium detection with graceful degradation

### Changed
- **Tool Count** increased from 149 to 167 total tools (75 WP + 74 WC + 18 Yoast)
- **Profile Count** increased from 11 to 14 predefined profiles
- **Profile Manager** now filters Yoast profiles when Yoast SEO is not active
- **Full Access Profile** now includes all Yoast SEO tools when Yoast SEO is active

### Technical
- **Conditional Yoast Tool Registration** - Yoast tools only register when Yoast SEO plugin is active
- **New Tool Class** - `Mountdev_AI_MCP_Connector\Tools\Yoast_SEO_Tools` with 18 tools
- **Premium Detection** - Multiple detection methods for Yoast SEO Premium (plugin file, class existence, redirect manager)
- **Capability Checks** - Read tools require `read` capability, write tools require `edit_posts`, redirect tools require `manage_options`
- **Error Handling** - Graceful errors when Yoast SEO or Premium is not available
- **Score Interpretation** - Helper methods for converting numeric scores to labels (good/ok/poor)

### Notes
- **No Breaking Changes** - Fully backward compatible with v1.1.x
- **Yoast SEO Optional** - Plugin works independently; Yoast tools only appear when Yoast SEO is active
- **Premium Features Optional** - Premium tools gracefully degrade when Yoast SEO Premium is not installed
- **Automatic Upgrade** - No migration or manual steps required

## [1.1.1] - 2026-04-14

### Changed
- Updated readme description for better clarity

### Fixed
- WooCommerce default profiles now properly hidden when WooCommerce plugin is deactivated
- Removed WooCommerce badge from FAQ section when WooCommerce is not active

### Commits
- 948d78d - docs: update readme description
- 0c4988b - chore: hide woo default profiles if woo plugin is deactivated
- b6a610f - chore: remove woo badge in FAQ

## [1.1.0] - 2026-04-10

### Added
- **74 WooCommerce Tools** across 3 new tool classes for comprehensive e-commerce management
  - **39 Product Tools** - Products, categories, tags, brands, attributes, variations, reviews, stock management
  - **11 Order Tools** - Orders, order notes, refunds with full CRUD operations
  - **24 Store Tools** - Coupons, shipping zones, tax rates, webhooks, payment gateways, reports, settings, system status
- **4 New Predefined Profiles**
  - `woo_read_only` - Safe read-only access to all WooCommerce data (~26 tools)
  - `woo_store_manager` - Product and order management with coupons and reports (~53 tools)
  - `woo_full_access` - All 74 WooCommerce tools
  - `complete_site` - All WordPress + WooCommerce tools (149 total)
- **WooCommerce Brands Extension Support**
  - 5 brand management tools (`wc_get_product_brands`, `wc_create_product_brand`, `wc_update_product_brand`, `wc_delete_product_brand`, `wc_assign_product_brand`)
  - Automatic detection and graceful degradation when extension is not active
  - Brand thumbnail support with WordPress media library integration
- **Global Product Attributes Management**
  - 8 attribute tools for creating and managing global product attributes
  - Attribute term management with full CRUD operations
  - Support for custom ordering (`menu_order`, `name`, `name_num`, `id`)
- **Enhanced Profile Manager UI**
  - WooCommerce section with purple branding (#7f54b3) separate from WordPress tools
  - Search functionality in custom profile creation modal
  - Category-based filter in profile editor
  - Section-level bulk select/deselect controls ("Select All WP" / "Select All Woo")
  - WooCommerce tools sub-grouped by domain (Products, Orders, Coupons, etc.)
- **Advanced Product Features**
  - Global Unique ID support (GTIN, UPC, EAN, ISBN) for WooCommerce 8.x+
  - Sold individually flag for purchase limits
  - Shipping dimensions (weight, length, width, height)
  - Shipping class assignment
  - Linked products (upsells and cross-sells)
  - Low stock product detection with configurable threshold
  - Batch product updates for bulk operations
- **Comprehensive Coupon Management**
  - Full coupon CRUD with all WooCommerce coupon fields
  - Usage restrictions (minimum/maximum amounts, product/category filters)
  - Email restrictions with wildcard support
  - Brand restrictions (requires WooCommerce Brands extension)
  - Usage limits (total and per-user)
  - Free shipping grants

### Changed
- **Profile Manager UI** now partitions tools into WordPress and WooCommerce sections
- **Tool Categories** expanded from 10 to 28 categories (18 new WooCommerce-specific categories)
- **Profile Editor Modal** includes search bar and category filter dropdown for easier tool discovery
- **Tool Count** increased from 75 WordPress tools to 149 total tools (75 WP + 74 WC)
- **Category Detection** logic updated to prioritize WooCommerce tool patterns before WordPress patterns

### Technical
- **Conditional WooCommerce Tool Registration** - WooCommerce tools only register when `class_exists('WooCommerce')` returns true
- **3 New Tool Classes**
  - `Mountdev_AI_MCP_Connector\Tools\Woo_Product_Tools` - 39 product-domain tools
  - `Mountdev_AI_MCP_Connector\Tools\Woo_Order_Tools` - 11 order-domain tools
  - `Mountdev_AI_MCP_Connector\Tools\Woo_Store_Tools` - 24 store-management tools
- **Lazy Tool Loading** - Tool Registry instantiates after all plugins load, ensuring accurate WooCommerce detection
- **WooCommerce API Integration**
  - Products: `wc_get_products()`, `WC_Product` classes, `->save()` pattern
  - Orders: `wc_get_orders()`, `wc_create_order()`, `WC_Order` class
  - Coupons: `WC_Coupon` class with comprehensive setter methods
  - Shipping: `WC_Shipping_Zones` API
  - Tax: `WC_Tax` class with direct database access for tax rates
  - Webhooks: `wc_get_webhooks()`, `WC_Webhook` class
  - Payment Gateways: `WC()->payment_gateways()` API
- **Capability Checks** - All WooCommerce write operations require `manage_woocommerce` capability
- **Error Handling** - Brand tools return `WP_Error` with code `brand_taxonomy_missing` when WooCommerce Brands is not active
- **Format Helpers** - Private methods for consistent data formatting across all WooCommerce tools

### Commits
- 1ac47ef - chore: added woo product tools
- cb23682 - chore: added woo order tools
- b01de10 - chore: added woo store tools
- 5a7cad6 - chore: update create order tool
- 2265082 - chore: implement predefined profiles for woocommerce
- 7f667c8 - chore: implement filter and search in custom profile
- c1395a0 - chore: improve admin ui
- 8854a9b - chore: added low stock param
- cfb581e - chore: woo banner
- 0d856f1 - chore: fix critical bug where WooCommerce tools were lost when editing profiles with WooCommerce deactivated
- 4c7072c - chore: remove third party logo

### Notes
- **No Breaking Changes** - Fully backward compatible with v1.0.0
- **WooCommerce Optional** - Plugin works independently; WooCommerce tools only appear when WooCommerce is active
- **Automatic Upgrade** - No migration or manual steps required
- **Profile Preservation** - Existing profiles remain unchanged and functional

## [1.0.0] - 2026-03-30

### Added
- Prompting guide for better AI integration
- FAQ disclaimer popup (shows once a month per user)
- Business advertisement section
- Disclaimer for plugin usage
- Advertisement images
- Claude AI integration support
- OAuth authentication guide
- Custom logo to plugin admin interface
- WordPress.org readme.txt with GPLv2 license declaration
- Delete permission warning for profiles with delete tools
- Delete confirmation modal warning for full access profile
- Comprehensive comments explaining public REST API endpoints
- Updated premium CTA links
- Implemented premium banner
- Added links in ads images

### Changed
- Moved business ad to the bottom of the interface
- Updated readme.txt content and formatting
- Updated logos and settings interface
- Updated readme tags and description
- Updated plugin name and branding
- Updated naming of tools for consistency
- Updated plugin description and details
- Updated tested WordPress version
- Rebranded plugin to address WordPress plugin directory requirements

### Fixed
- FAQ disclaimer popup now shows up once a month only (per-user)
- Application password connection tester not working
- Undefined scripts error
- Generic names updated with proper prefix
- Data sanitisation improvements
- Security improvements in user creation
- Plugin check errors resolved
- Logo side menu display
- Excluded todo files from package
- Removed unused languages folder
- Enqueued all JS/CSS using WordPress best practices
- Compliance with WordPress plugin directory requirements

### Security
- Improved data sanitization
- Enhanced security in user creation process
- All operations use `current_user_can()` checks
- Input validation for all parameters
- Nonce protection for admin forms

## [1.0.0-beta] - 2026-02-19

### Added
- **Core MCP Server Implementation**
  - JSON-RPC 2.0 endpoint at `/wp-json/cws-mcp/v1/messages`
  - Full MCP protocol compliance
  - Tool discovery via `tools/list` method
  - Initialize handshake support

- **Authentication & Security**
  - WordPress Application Passwords integration
  - HTTP Basic Authentication
  - Capability-based permission checks
  - Input sanitization and validation

- **Profile Management System**
  - 3 predefined profiles:
    - WordPress Read Only (safe read-only access)
    - Content Editor (create and edit content)
    - Content Manager (full content management)
  - Profile-based tool restrictions
  - Easy profile switching via admin interface

- **25 Essential Tools**
  - **Content Management (6 tools)**
    - wp_list_posts
    - wp_get_post
    - wp_create_post
    - wp_update_post
    - wp_delete_post
    - wp_search_posts
  
  - **Media Library (5 tools)**
    - wp_upload_media
    - wp_list_media
    - wp_get_media
    - wp_update_media
    - wp_delete_media
  
  - **Taxonomies (6 tools)**
    - wp_list_terms
    - wp_get_term
    - wp_create_term
    - wp_update_term
    - wp_delete_term
    - wp_assign_terms
  
  - **Comments (6 tools)**
    - wp_list_comments
    - wp_get_comment
    - wp_create_comment
    - wp_update_comment
    - wp_delete_comment
    - wp_moderate_comment
  
  - **Users (5 tools)**
    - wp_list_users
    - wp_get_user
    - wp_get_current_user
    - wp_list_roles
    - wp_check_capability
  
  - **Site Options (2 tools)**
    - wp_get_option
    - wp_get_site_info

- **Admin Interface**
  - Settings page with tabbed navigation
  - Quick Start guide
  - API endpoints display with copy functionality
  - Integration examples (cURL, JavaScript, Python)
  - Profiles management page
  - Active profile display
  - Enabled tools list by category

- **UI/UX Features**
  - Vanilla CSS styling
  - Vanilla JavaScript for interactions
  - Tab navigation with keyboard support (Arrow keys, Home, End)
  - Copy-to-clipboard functionality
  - Responsive design
  - Accessible interface

### Technical Details
- WordPress 5.8+ compatibility
- PHP 7.4+ support
- Zero external dependencies
- WordPress Coding Standards compliant
- Singleton pattern for core classes
- Proper namespacing
- Comprehensive error handling
- WP_Error integration

### Files Structure
```
cws-mcp/
├── assets/
│   ├── css/
│   │   └── admin.css
│   └── js/
│       └── admin.js
├── docs/
│   └── product.md
├── includes/
│   ├── admin/
│   │   ├── views/
│   │   │   ├── profiles.php
│   │   │   └── settings.php
│   │   └── class-admin.php
│   ├── tools/
│   │   ├── class-base-tool.php
│   │   ├── class-comment-tools.php
│   │   ├── class-media-tools.php
│   │   ├── class-post-tools.php
│   │   ├── class-site-tools.php
│   │   ├── class-taxonomy-tools.php
│   │   └── class-user-tools.php
│   ├── class-authenticator.php
│   ├── class-jsonrpc-handler.php
│   ├── class-profile-manager.php
│   ├── class-rest-controller.php
│   └── class-tool-registry.php
├── .htaccess
├── CHANGELOG.md
├── cws-mcp.php
├── index.php
└── README.md
```

## Roadmap

### Phase 2: Enhanced Features (Planned)
- SSE streaming endpoint
- Complete tool suite (55+ tools)
- All 6 predefined profiles
- Tools management interface
- Custom profile creation
- Profile import/export

### Phase 3: Polish & Documentation (Planned)
- Comprehensive documentation
- Code examples for integrations
- Performance optimization
- Security audit
- WordPress.org submission preparation

### Phase 4: Advanced Features (Future)
- Optional audit logging
- Webhook notifications
- Advanced rate limiting
- Multi-site support
- REST API v2 endpoint